Update value on field with spaces

Elastic Stack Kibana
1

I have a field in my elasticsearch that I wish to be able to update using the _update API. Currently I make a request and change the value of field FIELD to VALUE using this body:

{
   "script": {
    "source": "ctx._source.FIELD= params.class",
    "lang": "painless",
    "params": {
        "class": "VALUE"
        }
    }
}

However, when I show my data in Kibana, I want to use a more descriptive fieldname, such as TEST VALUES. My question is if there is a simple solution two make my two wishes come true?

I have tried field alias in ES, but the field never shows up in the index pattern in Kibana (I made sure to even try create a new index for this). I PUT the following body to my elasticsearch instance at http://localhost:9200/myindex/_mapping:

{
  "properties": {
    "TEST VALUES": {
      "type": "alias",
      "path": "FIELD"
    }
  }
}

I was not sure if this belongs to Kibana or Elasticsearch, but I hope there is only something missing in Kibana for the alias field to be visible.

2

Hi @Elaak,

unfortunately there is no way to do this in Kibana:

Currently Kibana will always reflect the actual field names.

3

Thank you for the solid answer. I am guessing for the time being it will have to be. But would Scripted fields be a possible solution? Do they update fields in real-time, so that I can calculate a new field based on the field I update, with no or minimal changes?

4

Yes, scripted fields would be an option for this - they are calculated at request time, which gives them a lot of flexibility with the cost of performance when it comes to large amounts of data (as they can't be indexed because of their dynamic nature). It's definitely a good start though (especially because it's so easy to do).

If the performance penalty becomes a problem, consider re-indexing your data with an ingest pipeline using a script processor - this is basically the same thing, but executed just once at ingest time. This means it's way harder to change a script (because you have to crunch through all of your data once), but after that's done it's as fast a regular fields.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.